WordPress Table Builder Plugin Authorization Bypass

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to trash or restore any post, page, or custom post type on the site by supplying arbitrary post IDs.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Table Builder plugin contains a critical authorization flaw affecting all versions through 2.2.1. An operator precedence bug in the trash_table_bulk() and restore_table_bulk() functions causes post-type validation guards to fail silently, combined with permission callbacks that only check plugin role membership without verifying per-post ownership or resource-level permissions. This allows authenticated attackers with minimal privileges to delete or restore arbitrary tables created by other users, leading to unauthorized data destruction and potential business disruption across WordPress installations.

Casky's 283 matched skills leverage Claude's extended reasoning to identify the MITRE ATT&CK patterns underlying this vulnerability: TA0004 (Privilege Escalation) is detected through recognition of authentication bypass logic flows and permission enforcement failures, while TA0006 (Credential Access/Defense Evasion) patterns emerge from analyzing how incomplete authorization checks allow lateral movement between user contexts. Practitioners using Casky would see findings highlighting suspicious bulk table operations, inconsistent permission validation chains, and the specific operator precedence antipatterns in PHP conditional statements—enabling security teams to hunt for exploitation attempts across their WordPress environments and patch before malicious use.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-6922.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-6922

Casky has 283 skills that investigate the attack patterns behind CVE-2026-6922. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn